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The Army Contracting Command — New Jersey (ACC-NJ), in supporting the Joint Project Manager 
— Medical Countermeasure Systems (JPM-MCS), issued MCDC RPP 20-11 on 09 June 2020. 
Members of the MCDC submitted proposals in accordance with this RPP. The Government received 
and evaluated all proposal(s) submitted and a Basis of Selection has been executed, selecting Pfizer, 
Inc. as the awardee. The Government requests that a Firm-Fixed-Price Project Agreement be issued 
to Pfizer, Inc. to award this proposal under Other Transaction Agreement W15QKN-16-9-1002, to be 
performed in accordance with the attached Government Statement of Work (SOW). 


Based upon the acceptable update of Pfizer, Inc.’s proposal for “COVID-19 Pandemic — Large Scale 
Vaccine Manufacturing Demonstration” and 1) The Project Agreement Recipient’s concurrence with 
the requirements included in the Government SOW; 2) An acceptable milestone schedule that meets 
SOW requirements, and; 3) The price proposed that has been analyzed by the Government, you are 
hereby directed to issue a Project Agreement to Pfizer, Inc. for the subject project. The total project 
value has been determined fair and reasonable and Pfizer, Inc.’s proposal has been selected IAW the 
above referenced Basis of Selection. 


The total approved cost to the Government for this effort is not to exceed $1,950,097,500.00. The 
break-out of the costs is as follows: $1,950,000,000.00 to perform project efforts included in the SOW 
and $97,500.00 for the Consortium Management Firm (CMF) Administrative Cost. The CMF 
Administrative Cost was approved as a “Special Allocation” for Operation Warp Speed (OWS) 
Prototype Projects executed under the MCDC OTA. The effort currently has $1,950,097,500.00 of 
available funding, comprised of $1,950,000,000.00 for the Project Agreement, $67,500.00 for the 
CMF Special Allocation, and $30,000 for other, non G&A, ATI costs, which will be incurred, tracked, 


and invoiced in accordance with Article V of the OTA. The COVID-19 work shall be tracked 
separately using the funding obligated via modification P00076. In alignment with the special 
allocation conditions, it is noted that this project has a base period of — 
a with a projected completion date _ A customized clause for the specia’ 


allocation, will be incorporated into the funding modification for this prototype project. 


The prime contractor is considered a small business, nontraditional defense contractor, or nonprofit 
research institution and determined to be providing a significant contribution. The affirmation of 
business status certifications submitted as part of the proposal are hereby incorporated into the 
agreement. The contractor shall notify the MCDC CMF of any deviation from the final proposed 
affirmation of business status certifications that would affect the contributions of the small business, 
nontraditional defense contractor, or nonprofit research institution as proposed. 


In accordance with 10.U.S.C. 2371b(f), and upon a determination that the prototype project for this 
transaction has been successfully completed, this competitively awarded prototype OTA may result 
in the award of a follow-on production contract or transaction without the use of competitive 
procedures. 


Points of Contact: 


Regards, 
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‘Agreements Officer 


Signed by: (NG) 


Attachments: 
Attachment 1: MCDC2011-003 — Pfizer - 7-21-2020 
Attachment 2: SOW Appendix 1 Clause for MCDC Consortium Other Transaction Authority Agreements 


Statement of Work 
For 
COVID-19 PANDEMIC-LARGE SCALE VACCINE MANUFACTURING 
DEMONSTRATION 


RPP #: 20-11 

Project Identifier: 2011-003 

Consortium Member: Member 

Title of Proposal: COVID-19 Pandemic--Large Scale Vaccine Manufacturing Demonstration 
Requiring Activity: Joint mission between the Department of Health and Human Services and 
Department of Defense to combat COVID-19 


1.0 INTRODUCTION, SCOPE, AND OBJECTIVES 
1.1 Introduction 


This Statement of Work (the “Statement of Work”) is hereby entered into, effective as of July 21, 
2020, pursuant to that certain Project Agreement by and between MCDC and Pfizer dated as of 
July 21, 2020 (“this Agreement” or “Project Agreement”). 


An outbreak of respiratory disease caused by a novel coronavirus was first detected in China in 
late 2019 and has now spread worldwide, including the United States (“US”). The virus has been 
named Severe Acute Respiratory Disease Coronavirus-2 (“SARS-CoV-2”) and causes 
Coronavirus Disease 2019 (“COVID-19”). On January 30, 2020, the International Health 
Regulations Emergency Committee of the World Health Organization (“WHO”), declared the 
outbreak a “Public Health Emergency of International Concern”. On January 31, the US 
Department of Health and Human Services Secretary (“HHS”), Alex M. Azar II, declared a Public 
Health Emergency for the US to aid the nation’s healthcare community in responding to COVID- 
19. On March 11, 2020, WHO publicly characterized COVID-19 as a pandemic. On March 13, 
2020 the President of the United States declared the COVID-19 outbreak a national emergency. 
The Government has identified COVID-19 vaccine candidates that are progressing rapidly through 
advanced research and development activities. 


Therefore, in response to a request by the Government, Pfizer is proposing to manufacture at-scale 
and fill-finish, for provision to the Government, a state-of-the-art candidate vaccine, developed in 
collaboration with BioNTech and capable of providing protection against the SARS-CoV-2 threat 
and related coronaviruses, subject to technical, clinical and regulatory success. 


Pfizer and BioNTech’s program aims to revolutionize the vaccine field by providing an mRNA 
candidate that, itself, has several key advantages, including the efficiency and flexibility of the 
platform — which is apparent by the pace of the vaccine development and the unprecedented phase 
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1/2/3 trial design that it supports. A clear fundamental difference of this candidate over more 
traditional modalities, such as viral vector vaccines, is that mRNA is delivered by protein-free lipid 
nanoparticles, which is believed to abolish the risk of anti-vector immunity and permit boosting to 
maximize the level and duration of immune responses. 


The mRNA vaccine technology is also intended to enable quick scale up of production, which is 
critical for bringing a COVID-19 vaccine to market to address this urgent medical need while 
preserving high quality and safety standards. 


The intent of this prototype project is to demonstrate that Pfizer has the business and logistics 
capability to manufacture 100M doses of its currently unapproved mRNA-based COVID-19 
vaccine for the Government ((}@5) using the Pfizer/BioNTech unique mRNA 
delivery system and its associated cold chain requirements, under pandemic conditions. This 
prototype project aims to significantly accelerate and secure US access to this promising medical 
countermeasure based on domestic manufacturing. 


1.1.1 BACKGROUND 


(b) ( Pfizer and BioNTech entered into an agreement for the co-development and 
distribution (excluding China) of a potential mRNA-based coronavirus vaccine aimed at 
preventing COVID-19 infection (the “Pfizer/BioNTech Agreement”). Under the Pfizer/BioNTech 
Agreement, 


for the 
revention 0: 


for the 
revention of 
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The collaboration has rapidly advanced multiple COVID-19 vaccine candidates into human 
clinical testing based on BioNTech’s proprietary mRNA vaccine platforms, with the objective of 
ensuring rapid worldwide access to the vaccine, if approved. The collaboration leverages Pfizer’s 
broad expertise in vaccine research and development, regulatory capabilities, and global 
manufacturing and distribution network. The two companies are jointly conducting clinical trials, 
and will also work jointly to commercialize the vaccine upon regulatory approval. 


Pfizer and BioNTech have already made substantial progress, outside this Statement of Work and 
without use of any Government funding, towards the demonstration of technical and 
manufacturing feasibility, including through the initiation of Phase 1/2 studies evaluating the 
likelihood of safety, tolerability and immunogenicity in the US and in Germany. The goal of the 
program is to rapidly develop and obtain regulatory licensure for a vaccine for use in adults >18 
years of age, followed by a possible pediatric and/ or maternal indication (to protect ~4M US 
pregnant women at risk each year). Both companies aspire to have an FDA-approved or authorized 
vaccine ready for administration in the US by October 31, 2020. Based on current information, 
Pfizer and BioNTech anticipate a 2-dose per patient regimen. 


This Statement of Work is designed toward establishing production capacity and distribution 
infrastructure sufficient to ensure that doses of the vaccine manufactured under this Agreement 
can be made available immediately for administration in the US, if clinical trials are successful 
and the FDA grants an Emergency Use Authorization (“EUA”) under Section 564 of the Federal 
Food, Drug, and Cosmetic Act or Biologics License Application (“BLA”) licensure under Section 
351(a) of the Public Health Service Act (hereafter “FDA-approved or authorized”). 


1.1.2 ACTIVITIES UNDERTAKEN WITHOUT GOVERNMENT FUNDING 


This section describes activities that Pfizer and BioNTech have been performing and will continue 
to perform without use of Government funding. These activities are described solely for 
background and context for the Government-funded deliverables itemized in Section 4. 


A. Regulatory Planning 


Pfizer will meet the necessary FDA requirements for conducting ongoing and planned clinical 
trials, and with its collaboration partner, BioNTech, will seek FDA approval or authorization for 
the vaccine, assuming the clinical data supports such application for approval or authorization. 
Given that these clinical trials are regulated by the FDA and HHS, there is no need for separate 
regulation by the U.S. Army Medical Research and Materiel Command. BioNTech is the 
Investigational New Drug (“IND”) holder, while Pfizer is the designated agent for all interactions 
with the FDA and is taking the lead on all communications with and submissions to FDA. 
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B. Clinical and Regulatory Approach 


BioNTech is the regulatory sponsor for trials of the vaccine and will be the applicant in the US for 
an EUA and/or a BLA, and will ultimately be the holder of any such approval issued in the US. 
Pfizer is BioNTech’s authorized agent to FDA. As noted above, Pfizer is the designated agent for 
all interactions with the FDA and is taking the lead on all communications with and submissions 
to FDA. 


Prior to commencing clinical development, on February 6, 2020, BioNTech obtained feedback 
from the Paul Ehrlich Institute (“PEI”) on plans for rapid vaccine development in response to the 
COVID-19 outbreak following a Scientific Advice Meeting. Based on the PEI feedback, 
BioNTech refined the clinical program plan and prepared a detailed protocol for FIH clinical study 
(BNT162). Additionally, a meeting was held by BioNTech on February 24, 2020 with the Chinese 
CDC to discuss a possible Special Review Procedure. 


In Germany, BioNTech began a Phase 1/2 study (BNT162-01) in late April 2020. BNT162-01 is 
a dose-escalation trial investigating the safety and immunogenicity of COVID-19 mRNA vaccine 
candidates in healthy adults. The primary objective of the study is to describe the safety and 
tolerability profiles of prophylactic BNT162 vaccine candidates after a single dose (for saRNA) 
or two doses separated by 21 days (uRNA and modRNA candidates). The secondary objective of 
the study is to describe the immune response to the vaccine in healthy adults, as measured by a 
functional antibody assay, such as virus neutralization. 


Informed by BNT162-01, the Phase 1/2 US study (C4591001) of the vaccine candidates started in 
May 2020. Pfizer and BioNTech utilized this approach to efficiently optimize formulation and 
dose selection in the clinic. Study C4591001 is a single, multistage and multi-phase trial (including 
the pivotal efficacy portion) designed to generate the data needed to achieve FDA approval or 
authorization for use of one of the vaccine candidates. This is a randomized, placebo-controlled, 
observer-blind, dose-finding and vaccine candidate-selection study in healthy adults. The study is 
evaluating the safety, tolerability, and immunogenicity of the COVID-19 mRNA vaccine 
candidates. 


The study consists of 3 stages: 

Stage 1: to identify preferred vaccine candidate(s), dose level(s), number of doses, and 
schedule of administration (with the first 15 participants at each dose level of each vaccine 
candidate comprising a sentinel cohort); 


Stage 2: an expanded-cohort stage; and 


Stage 3: a final candidate/dose large-scale stage. 
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Using this approach, Pfizer and BioNTech are efficiently working towards selection of final 
candidate/dose level. 


The study currently is being amended to incorporate a pivotal efficacy study design. Therefore, 
the study would be converted to a single Phase 1/2/3 study. The pivotal study portion (i.e., Phase 
2b/3) is expected to enroll up to ~30,000 subjects (1:1 randomized between vaccine and placebo). 


Upon gathering adequate safety and immunogenicity/efficacy data in a sufficient number of 
subjects, Pfizer believes the vaccine candidate could, with FDA’s agreement, be administered 
under EUA. 


As background, Pfizer’s and BioNTech’s activities to ensure provision of vaccine on a timely 
schedule may include the following discrete activities, depending on emerging data and regulatory 
guidance. 


Activity Success Criteria Estimated Timing 


Candidate, dose, and regimen | Decision endorsed by Pfizer-BioNTech 
selection Joint Steering Committee 


b) (4 
Phase 2b/3 Study Start Requires FDA (CBER) approval (1b) (4) 
b) (4) al 


Phase 1/2/3 Demonstration of | Adequate efficacy and safety data 
immunogenicity, efficacy | supports EUA application 
(interim analysis) and safety 


EUA Submission to Support | Acceptance of EUA submission (b) (4) 
Use in American Population 


BLA Submission to Support | Agreement from FDA (CBER) that | (G4) 
Use in American Population | proposed licensure package (preclinical, 
clinical, CMC) is acceptable 


EUA Issuance to Support Use | EUA issued (b) (4) 
in American Population 

BLA Approval to Support Use | BLA approval 

in American Population 

Post-Approval Commitments | Agreement with FDA 
Agreed 
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Cc. Chemistry Manufacturing Controls (CMC) 


Pfizer will complete the necessary CMC and scale-up activities to demonstrate the ability to 
manufacture 100M 4 | Pfizer will use diligent efforts 
to manufacture and quality release (using Pfizer’s quality system) 100M doses within the US ina 
non-preservative multi-dose ial 


Pfizer currently estimates potential production rates 

With GMP production expected to commence for drug product, this plan would 
allow for ~40M doses to be supplied under this Statement of Work in a. As Pfizer validates 
the facilities and makes continuous process improvements, Pfizer currently anticipates such 
production rate to increase starting in Should clinical data indicate that a lesser amount of 


dosage may be needed, there could be an increase in the anticipated potential number of doses 
supplied in 


As background, to help ensure delivery of the doses, Pfizer is undertaking the following CMC 
activities: 


1. Continue with BioNTech to manufacture initial clinical trial material for EU and US 
Phase 1/2/3 studies, through mRNA production in Germany and EU (Puurs, Belgium for fill- 
finish) and drug product/labelling operations at EU CMOs and establish EU based supply chain 


for lipid nanoparticle (LNP) formulation, fill, finish and distribution for commercial supply. 


2. Complete knowledge transfer of the technology and manufacturing process from 
BioNTech (and its CMO at Pfizer in the US, 


3. Obtain all raw material supplies for manufacturing. This may include support of 
existing third-party suppliers of raw materials, qualifying new third-party suppliers and/or in- 
jouse = of certain raw materials, ‘Ok ees 


4. Establish XC) mRNA (drug substance), lipid nanoparticle 
(LNP) formulation/fill finish (drug product) capacity for GMP Covid-19 pandemic supply of the 
NA-based COVID-19 vaccine on US soil. 


5. Develop the shipping model for the -80 °C drug product in consultation with CDC. 


In parallel, Pfizer is prepared to also evaluate alternative options including: 
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1. Conduct necessary stability and development studies to establish 


2.__Conduct_necessary formulation and_stability studies to develop (b) (4) | 


The CMC 


rogram may include, but not be limited to: (a) (XC) 

; (b) drug substance development; (c) drug product development (LNP formulation, 
; (d) analytical development in GLP and GMP setting; (e) GLP and GMP manufacturing; 
and (f) and shipping of -80 °C frozen product. 


(a) 


(b) Drug Substance Development: Pfizer shall scale-up its capabilities for process 
optimization, manufacture, analysis, release of GMP materials (mRNA) and securing necessary 
raw materials from third party providers. For drug substance manufacture, Pfizer seeks to build- 
out the existing purification suite located at Pfizer’s} 


izer shall supply incremental resources to transfer/implement new technology 
and GMP manufacturing processes, including technical experts, quality professionals, analytical 
technicians, and trained operational staff. 


(c) Drug Product Development (Lipid Nanoparticle (LNP Formulation, Fill-Finish)): 
Activities Pfizer shall perform may include, but are not be limited to, securing of necessary lipids 
for formulation and manufacturing process development for BNT162; defining the formulation; 
and initial development of manufacturing process and analytical methods. Pfizer will undertake to 


(d) Analytical Development: Analytical development may include, but not be limited 
to: methods transfer participation at receiving site and in-process testing support; process 
verification on commercial equipment; media fill runs: engineering trials; registration batch 
manufacture: and registration batch stability ( 
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(e) GLP and GMP Manufacturing: Packaging. storage and distribution of clinical trial 
lies for Phase 1/2 will be conducted by 


(f) Shipping of -80 °C frozen product: Pfizer is evaluating extension of current clinical 
ackaging configuration using soft boxes and dry ice. 


As background, to maintain a timely 
completion schedule of the vaccine, Pfizer 1s aspiring to undertake the following discrete activities, 
without Government funding: 


(b) (4) 


1.2 Scope 


The scope of this prototype project is the demonstration by Pfizer of the supply and logistics 
capability to manufacture and distribute to the Government of 100M doses of a novel mRNA- 
based vaccine that has received FDA-approval or authorization based on demonstration of efficacy 
(hereafter FDA-approved or authorized). The criteria for successful Emergency Use Authorization 
(EUA) are described in Emergency Use Authorization of Medical Products and Related 
Authorities: Guidance for Industry and Other Stakeholders, January 2017; and Development and 
Licensure of Vaccine to Prevent COVID-19: Guidance for Industry June 2020. The successful 
provision of these doses shall establish the effectiveness of a technology capable of potentially 
providing immediate and long-term solutions to coronavirus infections. While pre-clinical, 
clinical, and chemistry/manufacturing/controls (CMC) activities are described in the Background 
section of this Statement of Work, the Parties acknowledge and agree that such activities not 
related to the large-scale manufacturing demonstration are out-of-scope for this prototype project 
as Pfizer and BioNTech have and will continue to fund these activities, without the use of 
Government funding. 
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1.3 Objective 
(a) Prototype Project 


As set forth more fully in Section 11.7, the provisions of this Section 1.3 hereby supersede and 
replace, in their entirety, the provisions of Section 21.15 of the MCDC Base Agreement, 2020-532 
(July 2018) (“Base Agreement”). 


Consistent with the Government’s objectives under Operation Warp Speed, Pfizer intends to 
employ its proprietary manufacturing technology and processes, in a manner compliant with 
applicable laws and regulations, including 21 CFR 210 and 211 and the Drug Supply Chain 
Security Act (to the extent required for COVID-19 medical countermeasures, as defined by 
relevant FDA guidance), to manufacture and deliver vaccine. Success of the prototype project is 
defined as manufacture of 100M doses of Pfizer and BioNTech’s mRNA-based COVID-19 
vaccine and, upon FDA-approval or authorization as described above, delivery of those doses in 
accordance with Section 6.0. 


This effort constitutes a prototype project because it will be used to evaluate the technical 
feasibility of completion of the prototype project during the ongoing COVID-19 pandemic and 
unprecedented threats to several components of the prototype project. In addition, this is a 
prototype project because Pfizer will demonstrate and prove-out the at-scale, multi-lot proprietary 
manufacturing activities in order to assess the feasibility to support the necessary quantity of safe 
and effective doses required for vaccination of the U.S. population and deliver those doses within 
challenging cold chain requirements in accordance with Section 6.0. Successful completion of the 
prototype project will demonstrate Pfizer’s capability to (i) rapidly manufacture product, which 
can be further scaled-up to meet mutually agreed to surge requirements with limited advance 
notification and (ii) distribute large quantities of the FDA-approved or authorized drug product in 
accordance with Section 6.0. For clarity, any manufacturing and delivery of drug product in excess 
of the specific quantities set forth in Section 4.0 of this Statement of Work, shall be subject to a 
separate mutually acceptable production agreement between Pfizer and the Government. 


(b) — Follow-On Production Contract/Options 


In accordance with 10.U.S.C. § 2371b(f), and upon a determination that the prototype project is 
successful, or at the accomplishment of particularly favorable or unexpected results that would 
justify transition to production, the Government and Pfizer may enter into a non-competitive, 
mutually-acceptable, follow-on production agreement for additional manufacturing of the vaccine 
without the use of competitive procedures, which agreement shall reflect an unfunded option on 
the basis set forth in the following paragraph (the “Option”). 


Under the Option, the Government may request that Pfizer produce and deliver up to 500M 


additional doses for purchase by the Government for delivery 
a order placed pursuant to the Option Agreement will provide for a 
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minimum of 100M doses, provided that the aggregate number of doses ordered under the Option 
shall not exceed 500M. 


Upon any request pursuant to the Option, Pfizer shall inform the Government of appropriate lead 
times based on purchase of raw materials, capacity reservation and other factors, and Pfizer and 
the Government shall mutually agree on an appropriate estimated delivery schedule. Each order 
under the Option will be subject to the reasonably acceptance of Pfizer, it being understood that 


Pfizer shall have no paws: to accept any order pursuant to the Option that would involve 


As promptly as practicable following the effective date of this Agreement, the Government and 
Pfizer will agree in principle upon a form of production agreement reflecting the Option that can 
be executed as a binding agreement promptly upon Government request following such 
determination, demonstration, or accomplishment. 


2.0 APPLICABLE REFERENCES 
Current Good Manufacturing Procedures, 21 CFR 210 and 211. 
3.0 REQUIREMENTS 


Pfizer shall conduct manufacturing activities to support production and distribution of vaccine 
doses after the final vaccine candidate from its development program is selected (currently 
expected to occur in July 2020). Subject to the terms and conditions of this Agreement, including 
without limitation Sections 3.1, 6.0, 11.5 and 11.6, Pfizer shall use diligent efforts to manufacture, 
quality release (using Pfizer’s quality system), and deliver 100M doses of an FDA-approved or 
authorized vaccine in a preservative-free, multi-dose vial no later than the end of the period of 
performance (as defined in Section 3.1). 


Pfizer anticipates providing the vaccine, subject to FDA approval or authorization, as -80 °C frozen 
product that needs to be maintained at or below that temperature prior to dosing. The Government 
acknowledges that Pfizer’s responsibility for cold chain will cease upon delivery in accordance 
with Section 6.0. 


Pfizer anticipates providing the vaccine, subject to FDA-approval or authorization, as a 
concentrate that needs to be diluted at point of use prior to dosing. Vaccinators will need to use 
locally sourced 0.9% Sodium Chloride Injection, USP (Normal Saline), syringes and needles. 


3.1 Period of Performance 


The total proposed duration of this prototype initiative is 
with an expected completion date 
(the “period of performance”). If FDA-approval or authorization is not issued by October 31, 2020 
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as estimated in Section 1.1.2 above, and Pfizer expects it will be unable to timely complete 
performance, then the Parties will discuss in good faith a contract modification to shift forward the 
estimated delivery schedule to reflect the difference in time period between October 31, 2020 and 
the date of actual regulatory approval or authorization. 


As a result of these discussions, the Government shall have the unilateral ability to extend the 
Period of Performance of this prototype project in increments of up to thirty (30) days at a time. 
In no event can this unilateral right to extend the period of performance require performance 
(ORC) or result in a requirement for Pfizer to demonstrate the ability to 
manufacture more than 100M doses. 


Notwithstanding the efforts and estimated dates set forth throughout this Statement of Work, and 
as set out more fully in Sections 11.5 and 11.6, both Parties recognize that the vaccine is currently 
in Phase 1/2 clinical trials and that, despite the diligent efforts of Pfizer and BioNTech in research, 
and development and manufacturing, the prototype project may not be successful due to technical, 
clinical, regulatory or manufacturing challenges or failures. 


3.2 Management and Reporting 


As set forth more fully in Section 11.7, the provisions of this Section 3.2 hereby supersede and 
replace, in their entirety, Section 1.05 of the Base Agreement. 


Pfizer will not employ any new or other Project Management components and Pfizer shall have 
no obligation to provide any custom reports to the Government except as provided herein. The 
Government acknowledges that Pfizer plans to utilize existing Pfizer-formatted reports to provide 
this information to the Government as described in the Deliverable table below at Section 4.0. 


Pfizer shall provide (G3) technical reports providing an update of relevant ongoing non- 
Government funded activities. 


Pfizer shall provide, 
a synopsis of the Phase 2b/3 clinical trial protocol, which 


synopsis shall include [Overview of the Protocol, Objectives and Endpoints, Statistical Methods, 
and Schedule of Activities]. 


Pfizer shall provide copies of EUA and BLA filings, as well as interim and final data updates from 
clinical studies in a format determined by Pfizer. 


Pfizer shall provide weekly prototype production status reports, including the number of batches 
produced, doses in the batch, and release status of the finished doses. 


In addition to regular reporting requirements, during the period of performance, Pfizer shall use 
diligent efforts to notify the Government (G3) of any event, risk, formal or informal 
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FDA communication, or other issue that would be reasonably expected to materially change the 
anticipated schedule by one week or more. 


Except for reports expressly contemplated in this Statement of Work, Pfizer and the Government 
agree that Pfizer will not be subject to any reporting requirements contemplated in Section 1.05 of 
the Base Agreement. 


4.0 DELIVERABLES 


As set forth more fully in Sections 11.5 and 11.6, the Government understands that the dates set 
forth below are Pfizer’s best estimate, as of the Execution Date of this Agreement, of its 
development and manufacturing timelines, and that these timeframes are subject to significant 
risks and uncertainties. Pfizer will promptly notify the Government of any event(s) that would be 
reasonably expected to materially alter projected Estimated Due Date for Deliverables 4.1 through 
4.20. 


The Government agrees that it will not resell any of the deliverables to any third party. 


Deliverables 


Estimated Format SOW Government 
Due Date Reference Role 


Del. # Deliverable Description Data Rights 


Project Kick-Off Telecon. and Review 
materials related slides 
42 Phase 2b/3 Clinical Pfizer- Review 
Trial Synopsis determined 
format 
4.3 Provision of PL 115-92 Review/ 
Sponsor Authorization Approve 
Letter 
44 Pfizer- Review 
Prototype Production determined 
Status format 
4.5 Business and Pfizer- 
Technical Report determined 
format 


12 
‘This Statement of Work includes proprietary and confidential commercial data of Pfizer Inc. that shall not be disclosed outside the MCDC 
Management Firm and the Government and shall not be duplicated, used, or disclosed, in whole or in part, for any purpose other than to evaluate 
this Statement of Work and negotiate any subsequent award. If, however, an agreement is awarded as a result of, or in connection with, the 
submission of this data, the MCDC Management Firm and the Government shall have the right to duplicate, use, or disclose these data to the extent 
provided in the resulting agreement. This restriction does not limit the MCDC Management Firm and the Government's right to use the information 
contained in these data if they are obtained from another source without restriction. The data subject to this restriction are set forth on each page of 
this Statement of Work 


US 168054648v17 


4.6 | EUA Filing Pfizer- Review (0) (4)} 
determined 
format 
47 BLA Filing Pfizer- Review ((b) (4)} 
determined 
format 
48 Delivery of 100M [fix ia Receipt I | 
doses 
4.9 Release documentation Pfizer- ai Review i(b) (4)} 
for delivered doses determined 
format 
Supply Chain Pfizer- Review & (b) (4) 
Resiliency Plan or determined Comment 
Pfizer Equivalent format 
4, Manufacturing Data Pfizer - Review & (b) (4) 
Requirement or Pfizer determined Comment 
Equivalent format 
4. Product Development Pfizer- Review & (b) (4)} 
Source Material & determined Comment 
Manufacturing Reports format 
and Projections 
4, Work Location Report Pfizer- Review & (b) (4) 
or Pfizer Equivalent determined Comment 
format 
Facility Security Plan Pfizer- Review & (5) (4)} 
or Pfizer Equivalent determined Comment 
format 
4, Confirmation of i] Review {(b) (4)} 
Registration and 
Listing with FDA 
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this Statement of Work. 


4.16 | Formal Written val Review 
Responses from the 
FDA 


4.17 | FDA Inspection and Review oe) 


Compliance Notices, 
Observations and 
Responses 


4.18 Manufacturing 
Development Plan* 


4.19 | Quality Management 
Plan** 


4.20 | Shipping Specifications | Naam Review oe] 


and Details 


Manufacturing Development Plan. Pfizer will, 


describe the manufacturmg process for the vaccine product to ensure conformity with 
§501(a)(2)(B) of the Food, Drug, and Cosmetics Act (FD&C Act, Title 21 United States Code 
(“U.S.C.”) §351 (a)(2)(B)). regarding good manufacturing practices (“GMP”). This plan shall 
describe 


ality Management Plan. Pfizer will. 
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The Government acknowledges that, as set forth more fully in Section 1.1.2, the above deliverables 
(other than the delivery of doses contemplated by Section 4.5) are being prepared without the use 
of Government funding. 


As used herein, the term “Limited” means “limited rights” as that term is defined in DFARS 
252.227.7013(a)(14). 


5.0 MILESTONE PAYM 


NT SCHEDULE 


As set forth more fully in Section 11.7, the provisions of this Section 5 supersede and replace, in 
their entirety, the provisions of 5.04b of the Base Agreement. 


As the clinical trials and validation of the product presentation are ongoing, the estimated timing 
of delivery of doses is subject to change. Provided the FDA has granted approval or authorization, 
the 100M doses will be provided by Pfizer to the Government on a Firm Fixed Price per dose b: 
in accordance with the Milestone Payment Schedule. Due to variances in fill/finish yield, Pfizer 
shall invoice for and the Government, through the Consortium Management Firm (CMP), shall 
pay for actual quantities delivered, at a rate of $19.50 per dose. Subject to regulatory and technical 
success, Pfizer shall use its diligent efforts to provide the Government the full 100M doses on or 
before the final delivery date. 


Upon release, Pfizer will ship the doses to the Government as set forth in Section 6.0, below. Pfizer 
expects to invoice the Government (through the CMF) every month for released doses that have 
been shipped during each such monthly period. The CMF will pay all such invoices within thirty 
(30) days of receipt thereof. Pfizer shall submit invoices via email to MCDC-invoices@ati.org. 


(b) (4) 


n 
Total (Include Payment Type; FFP) $1.95B 
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Except as contemplated by the Option, the price per dose set forth in this Statement of Work is 
provided in connection with Operation Warp Speed and this specific Statement of Work only. This 
price shall not serve as the basis for pricing under any separate government contracts between 
Pfizer and HHS, the Department of Defense, or any other Department or agency of the Government 
by application of most favored customer, most favored nations, or any other contract or program- 
specific terms. 


For clarity, the Government will have no right to withhold payment in respect of any delivered 
doses, unless the FDA has withdrawn approval or authorization of the vaccine. In such event, the 
Parties will work in good faith to establish an appropriate course of action for delivered doses 
which have not yet been administered. By way of illustrative example only, 


6.0 SHIPPING PROVISIONS 


In coordination with the Government, Pfizer will conduct a demonstration of the shipping process 
prior to the first delivery of doses at a time mutually agreed by the Parties. As set forth in Section 
4.0, Pfizer agrees to share specifications and details associated with the shipping process and 
containers to enable the Government to adequately plan and prepare for potential distribution of 
the vaccine. 


Pfizer will notify the Government the date by which doses will become available for delivery. The 
Government will confirm dosage orders by ship-to location in advance of 
those dates: provided that each such ship-to location will abide by the specifications provided by 
Pfizer or will otherwise be agreed by Pfizer and the Government. The number of ship-to locations 
and the manner of delivery shall be identified to create an efficient delivery of the doses, subject 
to mutual agreement of the parties. The recommended delivery quantity for each ship-to location 
is 
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7.0 INTELLECTUAL PROPERTY, DATA RIGHTS, AND COPYRIGHTS 


As set forth more fully in Section 11.7, the provisions of this Section 7.0 supersede and replace, in 
their entirety, the provisions of Article X (Patent Rights), Article XI (Data Rights) of the Base 
Agreement. 


TA Inventions 


As between Pfizer and the Government, Pfizer shall hereby retain all of its rights, titles and 
interests in and to any and all inventions conceived and reduced to practice by Pfizer and/or 
BioNTech (i) as of the Effective Date of this Agreement, or (ii) after the Effective Date of this 
Agreement, outside the scope of this Statement of Work (“Background Inventions”). Pfizer does 
not grant to the Government any license to practice the Background Inventions under this 
Agreement. 


As between Pfizer and the Government, all inventions conceived or first actually reduced to 
practice in the performance of this Statement of Work (“Subject Inventions”) shall be owned by 
Pfizer. If invented solely by Pfizer, Pfizer will be able to elect, in its discretion, whether to hold 
Subject Inventions as trade secrets, and holding a Subject Invention as a trade secret will not forfeit 
title to the Government. Pfizer does not grant to the Government a license to practice any Subject 
Inventions on behalf of the Government. 


Notwithstanding the foregoing, and as set forth more fully in Section 1.1.2, the Government 
acknowledges that it is not funding the research or development of the vaccine, or CMC/process 
development in respect thereof. As such, neither Pfizer nor the Government anticipate the 
conception or reduction to practice of any Subject Inventions. 


The Government acknowledges that the Bayh-Dole Act does not apply to or govern this 
Agreement. Given that the Government will not fund the conception or reduction to practice of 
Background Inventions or Subject Inventions hereunder, this Agreement shall neither (i) give the 
Government any rights to “march-in,” as that term is defined in 35 U.S.C. § 203, nor (ii) subject 
Pfizer to the manufacturing requirements of 35 U.S.C. § 204. 


7.2 Data 


The Government recognizes that all data relating to the vaccine has been and will continue to be 
generated by Pfizer and its collaboration partner, BioNTech, without the use of Government 
funding. 


As between Pfizer and the Government, Pfizer shall own any and all data generated by Pfizer 
and/or BioNTech (i) as of the Effective Date of this Statement of Work, or (ii) after the Effective 
Date of this Statement of Work, outside the scope of this Statement of Work (“Background Data”). 
As between Pfizer and the Government, Pfizer also shall own any and all data generated by Pfizer 
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within the scope of this Statement of Work (“Subject Data”). For the avoidance of doubt, the 
parties do not anticipate Pfizer generating any Subject Data using Government funding. 


Pfizer hereby grants the Government a non-exclusive license to use any Background Data and 
Subject Data contained in the deliverables pursuant to Section 4, but solely to the extent necessary 
for the Government to perform its obligations under this Agreement and arrange administration of 
the doses delivered in accordance with FDA and other applicable regulations. 


The Government will provide Pfizer with no less than thirty (30) days’ written notice prior to 
releasing, in response to a Freedom of Information Act (FOIA) request, any document submitted 
by Pfizer to Government. During this 30-day period, Pfizer shall have the right to notify 
Government which documents, if any, contain trade secrets of Pfizer, BioNTech or their respective 
collaboration partners (or other information legally withholdable from release under FOIA). 


7.3 Regulatory Rights 


Pfizer will seek and anticipates that it will achieve FDA-approval or authorization and 
commercialization of Pfizer and BioNTech’s mRNA-based Vaccine against SARS-CoV-2 
Coronavirus (the “Technology”). 


Pfizer and the Government agree to the following: 


Communications. Pfizer will provide the Government with all formal written responses from the 
FDA regarding the Technology ()¥C3) 


Pfizer also shall use diligent efforts to provide to the USG Government any and all FDA inspection 
and compliance notices, observations, and responses from Pfizer a) 
TIDES The Government shall limit distribution of these documents to HHS an 
DoD regulatory personnel, and may share the substance of the documents to others within the DoD 
and HHS that have a need to know. 


DoD Medical Product Priority. PL 115-92 allows the DoD to request, and FDA to provide, 
assistance to expedite development of products to diagnose, treat, or prevent serious or life- 
threatening diseases or conditions facing American milita sonnel. Pfizer recognizes that onl 

the DoD can utilize PL 115-92. 


Public Law 115-92 Sponsor Authorization Letter that wil 
0c 


8.0 SECURITY / EXPORT CONTROL 


to the designated OWS 


As set forth more fully in Section 11.7, the provisions of this Section 8 supersede the provisions 
of Article XII (Export Controls). The following requirements of Article XVII (Security and 
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OPSEC) of the Base Agreement are not applicable and are therefore self-deleting and replaced by 
this Section: all references to CUI and CDI, sub-paragraphs (1) through (20) excepting sub- 
Paragraphs (3)(e), (4), and (20)(d). 


The security classification for this effort is Unclassified. As it is currently not anticipated that any 
Controlled Unclassified Information (“CUI”) will be obtained under this Statement of Work, other 
than Pfizer proprietary information, DFARS 252.204-8012 shall not apply. In addition, the 
training requirements of Article XVII of the Base Agreement shall not apply. However, if CUI is 
provided, Pfizer will keep all such information confidential and will only give access to such 
information to persons with a legitimate need for such access. 


Pfizer agrees to comply with all applicable laws regarding commodities and technology subject to 
this Statement of Work. Pfizer will submit plans and reports as set forth in Section 4.0 above 
addressing the security topics generally contemplated by Appendix 1 to this Statement of Work. 
The Government acknowledges that these plans will reflect Pfizer’s established security 
procedures in place with respect to its facilities and information security, which are at least as 
protective as would be customary for a global company. Pfizer will use commercially reasonable 
efforts to implement any further procedures/precautions reasonably requested by the Government 
with respect to Statement of Work and Appendix 1, at Pfizer’s sole discretion and as long as such 
implementation would not adversely impact Pfizer’s ordinary operation of its facilities and systems 
in connection with its other business and products. 


9.0 MISCELLANEOUS REQUIREMENTS (SAFETY, ENVIRONMENTAL, ETC.) 
Intentionally Left Blank. 
10.0 GOVERNMENT FURNISHED PROPERTY/MATERIAL/INFORMATION 


As set forth more fully in Section 11.7, the provisions of this Section 10.0 supersede and replace, 
in their entirety, the provisions of Article XIII (Title and Disposition of Property) of the Base 
Agreement. 


There will be no Government furnished equipment, and no equipment will be funded by the 
Government under this Statement of Work. 


11.0 OTHER 
11.1. PREP Act. 


In accordance with the Public Readiness and Emergency Preparedness Act (“PREP Act”), Pub. L. 
No. 109-148, Division C, Section 2, as amended (codified at 42 U.S.C. § 247d-6d and 42 U.S.C. 
§ 247d-6e), as well as the Secretary of HHS’s Declaration Under the Public Readiness and 
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Emergency Preparedness Act for Medical Countermeasures Against COVID-19, 85 Fed. Reg. 
15198 (Mar. 17, 2020, effective Feb. 4, 2020), and amended on April 15, 2020, 85 Fed. Reg. 
21012, and on June 8, 2020, 85 Fed. Reg 34740 (together, the “Prep Act Declaration”): 


(i) This Agreement is being entered into for purposes of facilitating the manufacture, 
testing, development, distribution, administration, and use of “Covered 
Countermeasures” for responding to the COVID-19 public health emergency, in 
accordance with Section VI of the PREP Act Declaration; 


(ii) Pfizer’s performance of this Agreement falls within the scope of the “Recommended 
Activities” for responding to the COVID-19 public health emergency in accordance 
with Section III of the PREP Act Declaration; and 


(iii) Pfizer is a “Covered Person” per Section V of the PREP Act Declaration. 


Therefore, in accordance with Sections IV and VII of the PREP Act Declaration as well as the 
PREP Act (42 U.S.C. § 247d-6d), the Department of Defense contracting via assisted acquisition 
on behalf of the HHS, expressly acknowledges and agrees that the HHS Declaration cited above, 
specifically its language providing immunity from suit and liability is applicable to this 
Agreement, as long as Pfizer’s activities fall within the terms and conditions of the PREP Act and 
the PREP Act Declaration. 


The Government may not use, or authorize the use of, any products or materials provided under 
this Agreement, unless such use occurs in the United States and is protected from liability under a 
declaration issued under the PREP Act, or a successor COVID-19 PREP Act declaration of equal 
or greater scope. 


11.2. Terminations. As set forth more fully in Section 11.7, the provisions of this Section 11.2 
hereby supersede and replace, in their entirety, Sections 2.03 and 2.06 of the Base Agreement: 


Om(b) (4) 
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(b) Stop-Work Orders. Except as required by applicable law or regulation, or judicial or 
administrative order, the Government shall not have the authority to issue a Stop-Work Order to 
halt the work contemplated under this Statement of Work. 


(c) Consequences of Termination. In the event of termination of this Agreement pursuant 
to this Section 11.2, or expiration of this Agreement at the end of the period of performance as set 
forth in Section 3.1, this Agreement shall forthwith become null and void and have no effect, 
without any liability on the part of any Party; provided, however, that Sections 7, 11 and 12 hereof, 
and Article VIII (Confidential Information) of the Base Agreement, shall survive any termination 
or expiration of this Agreement; and provided, further, that the termination or expiration of this 
Agreement shall not release any Party hereto of any liability, including any outstanding payments 
of the Government for doses previously delivered hereunder, which at the time of termination or 
expiration had already accrued to the other party in respect to any act or omission prior thereto. 


11.3 Audits. As set forth more fully in Section 11.7, the provisions of this Section 11.3 hereby 
supersede and replace, in their entirety, the provisions of Section 5.07 (Financial Records and 
Reports) of the Base Agreement. 


Pfizer’s relevant financial records shall not be subject to audit until the Government has provided 
funds to Pfizer. These records will be subject to audit for a period not to exceed three (3) years 
after final payment under this Agreement. Pfizer shall have the right to request use of a third-party 
audit firm to audit Pfizer’s books and records maintained in connection with this Agreement; 
however, in accordance with 10 U.S.C. § 2371b(c) for a period not to exceed three (3) years after 
final payment under this Agreement, the Comptroller General shall have access to examine the 
records of any party to the agreement or any entity that participates in the performance of the 
agreement. 


11.4 Disputes. As set forth more fully in Section 11.7, Section 7.02 of the Base Agreement is 
hereby amended to add the following at the end of said section: 


The Government’s breach of this Statement of Work may result in money damages and nothing in 
the Project Agreement (if any) or Base Agreement prevents Pfizer from seeking relief in the United 
States Court of Federal Claims pursuant to 28 U.S.C. § 1491. 


11.5 Timing Estimates. All timing estimates set forth in this Statement of Work are subject to 
change based on emerging data, regulatory guidance, and manufacturing and_ technical 
developments, among other risks. 
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11.6 Limitation of Liability. The Government acknowledges and agrees that Pfizer’s efforts to 
develop and manufacture a vaccine intended to prevent COVID-19 disease caused by SARS-CoV- 
2 are aspirational in nature and subject to significant risks and uncertainties. Accordingly, 
notwithstanding anything to the contrary in this Statement of Work or the Base Agreement, Pfizer 
shall have no liability for any failure to develop, obtain or maintain U.S. regulatory approval or 
authorization of such a vaccine in accordance with the estimated schedule described in this 
Statement of Work. 


Even if a vaccine is successfully developed and obtains U.S. regulatory approval or authorization, 
Pfizer shall have no liability for any failure to deliver doses in accordance with the estimated 
delivery dates set forth in this Statement of Work to the extent any such change in delivery dates 
is based on emerging data, regulatory guidance, manufacturing and technical developments, or 
other risks outside Pfizer’s control; provided, however, Government retains the right to terminate 
this Agreement or to issue a Stop-Work Order, as specifically contemplated in Sections 11.2(1) 
and 11.2(b). 


us Section 11.6 supersedes the Base Agreement’s other liability 
provisions solely to the extent they are inconsistent with this Statement of Work. 


11.7 Order of Precedence. Notwithstanding the provisions of Article XXIII (Order of 
Precedence) of the Base Agreement, the Parties hereby expressly agree that to the extent any 
provision of the Project Agreement (if any) or this Statement of Work conflicts with any provision 
of the Base Agreement, the provision of the Project Agreement (if any) or this Statement of Work, 
as applicable, shall supersede and replace, in the entirety, the conflicting provision of the Base 
Agreement and control the relationship of the Parties. 


Without limiting the generality of the foregoing, this Section 11.7 shall supersede Article XXII 
(Order of Precedence) of the Base Agreement and the terms of this Statement of Work shall 
constitute “specifically negotiated Project Agreement terms” referenced in the last sentence 
thereof. 


This Statement of Work hereby supersedes, without limitation, the following provisions of the 
Base Agreement: Section 1.05 (Reporting Requirements), Section 2.03 (Termination Provisions), 
Section 2.06 (Stop-Work), Section 5.07 (Financial Records and Reports), Section 8.05 (Term), 
Article IX (Publications), Article X (Patent Rights), Article XI (Data Rights), XII (Export 
Controls), Article XIII (Title and Disposition of Property), Article XVII (Security and OPSEC), 
and Sections 21.6-21.15 (Regulations) and the integration clause above the signature block to the 
Base Agreement. 
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11.8 


11.9 Non-Traditional Defense Contractor. Pfizer has self-certified that Pfizer meets the 
definition of a “Nontraditional Defense Contractor” as defined in the Base Agreement and 
therefore is not subject to the cost-sharing requirement referenced in Article VI of the Base 
Agreement. 


11.10 Confidentiality. As set forth more fully in Section 11.7, the provisions of this Section 
11.10 hereby supersede and replace, in their entirety, the provisions of Section 8.05 of the Base 
Agreement. 


The obligations of the Receiving Party under this Section shall continue for a period of ten (10) 
years from the conveyance of Confidential Information. If Pfizer shall need to disclose trade secret 
information to the Government, Pfizer and the Government will first determine in good faith 
whether the Government desires to receive any such trade secret information and if the 
Government so desires to receive such trade secret information, all such information shall be held 
by the Government in confidence in perpetuity. 


11.11 Announcements. Neither Pfizer nor the Government shall make, or permit any person to 
make, any public announcement concerning the existence, subject matter or terms of this 
Agreement, the transactions contemplated by it, or the relationship between the Pfizer and the 
Government hereunder, without the prior written consent of the other, such consent not to be 
unreasonably withheld or delayed, except as required by law, any governmental or regulatory 
authority (including, without limitation, any relevant securities exchange), any court or other 
authority of competent jurisdiction. Notwithstanding the foregoing, Pfizer and (its collaboration 
partners) shall have the right, but not the obligation, to prepare and submit scientific publications 
and release information to the public about its Covid-19 development program, without the 
Government’s consent or involvement. This section supersedes and replaces Article IX of the 
Base Agreement. 


12.0 AGREEMENTS OFFICER’S REPRESENTATIVE (AOR) AND ALTERNATE 
AOR CONTACT INFORMATION 


AOR 


NAME: (QO) 
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Appendix 1: Clause for MCDC Consortium Other Transaction Authority 
Agreements 


Standard Language OWS for Consortium OTA 


Required MCDC Base Agreement Modifications 


The Medical CBRN Consortium (MCDC) Base Agreement, Article XVII, SECURITY & OPSEC shall apply to this Project 
Agreement. In addition, the below language shall replace Paragraph 6 of Article XVII of the MCDC Base Agreement. 


(6) Access and General Protection/Security Policy and Procedures. This standard language text is applicable to ALL PAH 
employees working on critical program information or covered defense information related to Operation Warp Speed (OWS), and 
to those with an area of performance within an Army controlled installation, facility or area. PAH employees shall comply with 
applicable installation, facility and area commander installation/facility access and local security policies and procedures (provided 
by government representative). The PAH also shall provide all information required for background checks necessary to access 
critical program information or covered defense information related to OWS, and to meet installation access requirements to be 
accomplished by installation Provost Marshal Office, Director of Emergency Services or Security Office. The PAH workforce 
must comply with all personal identity verification requirements as directed by DOD, HQDA and/or local policy. In addition to the 
changes otherwise authorized by the changes clause of this agreement, should the Force Protection Condition (FPCON) at any 
individual facility or installation change, the Government may require changes in PAH security matters or processes. 


Required SOW Language for Deliverables (in body of SOW or Deliverables 
Section) 


Information Security 
Classification guidance for Operation Warp Speed - The security level for this agreement is UNCLASSIFIED. 


“Controlled technical information,” “covered contractor information system,” “covered defense information,” “cyber incident,” 
“information system,” and “technical information” are defined in DFARS Clause 252.204-7012, Safeguarding Covered Defense 
Information and Cyber Incident Reporting. 


Personnel Security 


In addition to the industry standards for employment background checks, The Contractor must be willing to have key individuals, 
in exceptionally sensitive positions, identified for additional vetting by the United States Government. 


Supply Chain Resiliency Plan 
The contractor shall develop and submit within 30 calendar days after contract award, a comprehensive Supply Chain Resiliency 
Program that provides identification and reporting of critical components associated with the secure supply of drug substance, drug 
product, and work-in-process through to finished goods. 
a) A critical component is defined as any material that is essential to the product or the manufacturing process associated 
with that product. Included in the definition are consumables and disposables associated with manufacturing. NOT 
included in the definition are facility and capital equipment. 


Consideration of critical components includes the evaluation and potential impact of raw materials, excipients, active ingredients, 
substances, pieces, parts, software, firmware, labeling, assembly, testing, analytical and environmental componentry, reagents, or 
utility materials which are used in the manufacturing of a drug, cell banks, seed stocks, devices and key processing components 
and equipment. A clear example of a critical component is one where a sole supplier is utilized. 


The contractor shall identify key equipment suppliers, their locations, local resources, and the associated control processes at the 
time of award. This document shall address planning and scheduling for active pharmaceutical ingredients, upstream, downstream, 
component assembly, finished drug product and delivery events as necessary for the delivery of product. 

a) Communication for these requirements shall be updated as part of an annual review, or as necessary, as part of regular 
contractual communications. 

b) For upstream and downstream processing, both single-use and re-usable in-place processing equipment, and 
manufacturing disposables also shall be addressed. For finished goods, the inspection, labeling, packaging, and associated 
machinery shall be addressed taking into account capacity capabilities. 

c) The focus on the aspects of resiliency shall be on critical components and aspects of complying with the contractual 
delivery schedule. Delivery methods shall be addressed, inclusive of items that are foreign-sourced, both high and low 
volume, which would significantly affect throughput and adherence to the contractually agreed deliveries. 


The contractor shall articulate in the plan, the methodology for inventory control, production planning, scheduling processes and 
ordering mechanisms, as part of those agreed deliveries. 
a) Production rates and lead times shall be understood and communicated to the Contracting/Agreement Officer or the 
Contracting/Agreement Officer's Representative as necessary. 
b) Production throughput critical constraints should be well understood by activity and by design, and communicated to 
contractual personnel. As necessary, communication should focus on identification, exploitation, elevation, and secondary 
constraints of throughput, as appropriate. 


Reports for critical items should include the following information: 
a) Critical Material 
b) Vendor 
c) Supplier, Manufacturing / Distribution Location 
d) Supplier Lead Time 
e) Shelf Life 
f) Transportation / Shipping restrictions 


The CO and COR reserve the right to request un-redacted copies of technical documents, during the period of performance, for 
distribution within the Government. Documents shall be provided within ten (10) days after CO issues the request. The Contractor 
may arrange for additional time if deemed necessary, and agreed to by the CO. 


Manufacturing Data Requiremen 
The Contractor shall submit within 30 calendar days after award detailed data regarding project materials, sources, and 
manufacturing sites, including but not limited to: physical locations of sources of raw and processed material by type of material; 
location and nature of work performed at manufacturing, processing, and fill/finish sites; and location and nature of non-clinical 
and clinical studies sites. The Government may provide a table in tabular format for Contractor to be used to submit such data 
which would include but not be limited to the following: 

¢ — Storage/inventory of ancillary materials (vials, needles, syringes, etc.) 
Shipment of ancillary materials (vials, needles, syringes, etc.) 
Disposal of ancillary materials (vials, needles, syringes, etc.) 
Seed development or other starting material manufacturing 
Bulk drug substance and/or adjuvant production 
Fill, finish, and release of product or adjuvant 
Storage/inventory of starting materials, bulk substance, or filled/final product or adjuvant 
Stability information of bulk substance and/or finished product 
Shipment of bulk substance of final product 
Disposal of bulk substance or final product 


Product Development Source Material and Manufacturing Reports and Projections: 


The Contractor shall submit a detailed spreadsheet regarding critical project materials that are sourced from a location other than 
the United States, sources, and manufacturing sites, including but not limited to: physical locations of sources of raw and processed 
material by type of material; location and nature of work performed at manufacturing sites; and location and nature of non-clinical 
and clinical study sites. 


The Contractor will provide manufacturing reports and manufacturing dose tracking projections/actuals utilizing the “COVID-19 
Dose Tracking Templates”, on any contract/agreement that is manufacturing product 
¢ Contractor will submit Product Development Source Material Report 
o Within month of contract award 
o Within 30 days of substantive changes are made to sources and/or materials 
o  Oron the 6" month contract anniversary. 
e Contractor will update the Dose Tracking Template weekly, during manufacturing campaigns and COVID response, with 
the first deliverable submission within 15 days of award/modification 
e¢ ~The Government will provide written comments to the Product Development Source Material and Manufacturing Report 
within 15 business days after the submission 
e — If corrective action is recommended, Contractor must address all concerns raised by the Government in writing 


Contractor Locations: 
The contractor shall submit detailed data regarding locations where work will be performed under this contract, including 
addresses, points of contact, and work performed per location, to include sub-contractors. 
Contractor will submit Work Locations Report: 
e Within 5 business days of contract award 
¢ Within 30 business days after a substantive location or capabilities change 
e Within 2 business days of a substantive change if the work performed supports medical countermeasure development that 
addresses a threat that has been declared a Public Health Emergency by the HHS Secretary or a Public Health Emergency 
of International Concern (PHEIC) by the WHO 


Required SOW Language for Security Section 


This project requires an OPSEC Plan and a Security Plan. 


The contractor shall develop a comprehensive security program that provides overall protection of personnel, information, data, 
and facilities associated with fulfilling the Government requirement. This plan shall establish security practices and procedures that 
demonstrate how the contractor will meet and adhere to the security requirements outlined below prior to the commencement of 
product manufacturing, and shall be delivered to the Government within 30 calendar days of award. The contractor shall also 
ensure all subcontractors, consultants, researchers, etc. performing work on behalf of this effort, comply with all Operation Warp 
Speed and Project Agreement security requirements and prime contractor security plans. 

a) The Government will review in detail and submit comments within ten (10) business days to the Contracting Officer (CO) 
to be forwarded to the Contractor. The Contractor shall review the Draft Security Plan comments, and, submit a Final 
Security Plan to the U.S. Government within thirty (10) calendar days after receipt of the comments. 

b) The Security Plan shall include a timeline for compliance of all the required security measures outlined by the 
Government. 

c) Upon completion of initiating all security measures, the Contractor shall supply to the Contracting Officer a letter 
certifying compliance to the elements outlined in the Final Security Plan. 


Ata minimum, the Final Security Plan shall address the following items: 


Security Requirements: 


1. Facility Security Plan 
Description: As part of the partner facility’s overall security program, the contractor shall submit a written security 
plan with their proposal to the Agreement Officer for review and approval by Operation Warp Speed security 
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organization chart = Teapanailies 

Security Administration written security risk assessment for site 

threat levels with identification matrix (High. Medium, or Low) 
enhanced security procedures during elevated threats 
liaison procedures with law enforcement 

annual employee security education and training program 
policies and procedures 

Personnel Security candidate recruitment process 

background investigations process 

employment suitability policy 

employee access determination 

tules of behavior/ conduct 

termination procedures 

non-disclosure agreements 

Physical Security Policies internal/external access control 

and Procedures protective services 

identification/badging 

employee and visitor access controls 

parking areas and access control 

perimeter fencing/barriers 

product shipping, receiving and transport security procedures 
facility security lighting 

restricted areas 

signage 

intrusion detection systems 

alarm monitoring/response 

closed circuit television 

product storage security 

other control measures as identified 

Information Security identification and marking of sensitive information 
access control 

storage of information 

document control procedures 

retention/ destruction requirements 

Information intrusion detection and prevention systems 
Technology/Cyber Security threat identification 

Policies and Procedures employee training (initial and annual) 

encryption systems 

identification of sensitive information/media 
password policy (max days 90) 

lock screen time out policy (minimum time 20 minutes) 
removable media policy 

laptop policy 

removal of IT assets for domestic/foreign travel 
access control and determination 

‘VPN procedures 

WiFi and Bluetooth disabled when not in use 


2. Site Security Master Plan 


system document control 
system backup 

system disaster recovery 
incident response 
system audit procedures 
property accountabili 


Description: The partner facility shall provide a site schematic for security systems which includes: main access 
points; security cameras; electronic access points; IT Server Room; Product Storage Freezer/Room; and bio- 


containment laboratories. 


3. Site Threat / Vulnerability / Risk Assessment 
Description: The partner facility shall provide a written risk assessment for the facility addressing: criminal threat, 
including crime data; foreign/domestic terrorist threat; industrial espionage; insider threats; natural disasters; and 
potential loss of critical infrastructure (power/water/natural gas, etc.) This assessment shall include recent data 
obtained from local law enforcement agencies. The assessment should be updated annually. 


Closed Circuit Television 
(CCTV) Monitoring 


Facility Lighting 


Shipping and Receiving 


Access Control 


Layered (internal/external) CCTV coverage with time-lapse video 
recording for buildings and areas where critical assets are processed or 
stored. 

CCTV coverage must include entry and exits to critical facilities, 
perimeters, and areas within the facility deemed critical to the execution of 
the contract. 

Video recordings must be maintained for a minimum of 30 days. 

CCTV surveillance system must be on emergency power backup. 

CCTV coverage must include entry and exits to critical facilities, 
perimeters, and areas within the facility deemed critical to the execution of 
the contract. 


Video recordings must be maintained for a minimum of 30 days. 


Lighting must cover facility perimeter, palling areas, critical 
infrastructure, and entrances and exits to buildings. 

Lighting must have emergency power backup. 

Lighting must be sufficient for the effective operation of the CCTV 
surveillance system during hours of darkness. 

Must have CCTV coverage and an electronic access control system. 
Must have procedures in place to control access and movement of drivers 
picking up or delivering shipments. 

Must identify drivers picking up Government products by government 
issued photo identification. 

Must have an electronic intrusion detection system with centralized 
monitoring. 

Responses to alarms must be immediate and documented in writing. 
Employ an electronic system (i.e. card key) to control access to areas 
where assets critical to the contract are located (facilities, laboratories, 
clean rooms, production facilities, warehouses, server rooms, records 
storage, etc.). 

The electronic access control should signal an alarm notification of 
unauthorized attempts to access restricted areas. 

Must have a system that provides a historical log of all key access 
transactions and kept on record for a minimum of12 months. 


Employee/Visitor 
Identification 


Security Fencing 


Protective Security Forces 


Protective Security Forces 


Operations 


Security Management 


Records Checks 


f) Must have procedures in place to track issuance of access cards to 
employees and the ability to deactivate cards when they are lost or an 
employee leaves the company. 

g) Response to electronic access control alarms must be immediate and 
documented in writing and kept on record for a minimum of 12 months. 

h) Should have written procedures to prevent employee piggybacking access 

i) to critical infrastructure (generators, air handlers, fuel storage, etc.) should 
be controlled and limited to those with a legitimate need for access. 

j) Must have a written manual key accountability and inventory process. 

k) Physical access controls should present a layered approach to critical 
assets within the facility. 

Should issue company photo identification to all employees. 

Photo identification should be displayed above the waist anytime the 

employee is on company property. 

Visitors should be sponsored by an employee and must present 

government issued photo identification to enter the property. 

Visitors should be logged in and out of the facility and should be escorted 

employee while on the premises at all times. 

Requirements for security fencing will be determined by the criticality of the 
program, review of the security plan, threat assessment, and onsite security 
assessment. 
Requirements for security officers will be determined by the criticality of the 
program, review of the security plan, threat assessment, and onsite security 
assessment. 

Must have in-service training program. 

Must have Use of Force Continuum. 

Must have communication systems available (i.e.. landline on post, cell 

phones, handheld radio, and desktop computer), 

Must have Standing Post Orders. 

Must wear distinct uniform identifyi 


Establish formal liaison with law enforcement. 
Meet in person at a minimum annually. Document meeting notes and keep 
them on file for a, minimum of 12 months. POC information for LE 
Officer that attended the meeting must be documented. 

mplement procedures for receiving and disseminating threat information. 
Conduct new employee security awareness training. 
Conduct and maintain records of annual security awareness training. 
Designate a knowledgeable security professional to manage the security of 
the facility. 
Ensure subcontractor compliance with all Government security 


Verification of social security number, date of birth, citizenship, education 
credentials, five-year previous employment history. five-year previous residence 
history. FDA disbarment. sex offender registry, credit check based upon position 
within the company: motor vehicle records check as appropriate: and local/national 
criminal history search. 


Hiring and Retention 
Standards 


a) Detailed policies and procedures concerning hiring and retention of 
employees, employee conduct, and off boarding procedures. 


b) 


Off Boarding procedures should be accomplished within 24 hour of 
employee leaving the company. This includes termination of all network 
access. 


Physical DOCuinelt Control 


Document Destruction 


Identity Management 


Access Control 


Audit and Accountability 


a) 


b) 


°) 
d) 


Applicable documents shall be identified and marked as procurement 
sensitive, proprietary, or with appropriate government markings. 

Sensitive, proprietary, and government documents should be maintained in 
a lockable filing cabinet/desk or other storage device and not be left 
unattended. 

Access to sensitive information should be restricted to those with a need to 


Physical devices and systems within the organization are inventoried and 
accounted for annually. 

Organizational cybersecurity policy is established and communicated. 
Asset vulnerabilities are identified and documented. 

Cyber threat intelligence is received from information sharing forums and 


sources. 

Threats, vulnerabilities, likelihoods, and impacts are used to determine 
risk. 

Identities and credentials are issued, managed, verified, revoked, and 
audited for authorized devices, users and processes. 

Users, devices, and other assets are authenticated (e.g., single-factor, 
multifactor) commensurate with the risk of the transaction (e.g., 
individuals’ security and privacy risks and other organizational risks 
Limit information system access to authorized users. 

Identify information system users, processes acting on behalf of users, or 
devices and authenticate identities before allowing access. 

Limit physical access to information systems, equipment, and server 
rooms with electronic access controls. 

Limit access to/ verify access to use of external information systems. 
Ensure that personnel are trained and are made aware of the security risks 
associated with their activities and of the applicable laws, policies, 
standards, regulations, or procedures related to information technology 


Create, protect, and retain information system audit records to the extent 
needed to enable the monitoring. analysis, investigation, and reporting of 
unlawful, unauthorized, or inappropriate system activity. Records must be 
kept for minimum must be kept for 12 months. 

Ensure the actions of individual information system users can be uniquely 
traced to those users. 

Update malicious code mechanisms when new releases are available. 
Perform periodic scans of the information system and real time scans of 
files from external sources as files are downloaded, opened. or executed. 


Configuration Management 


a) 
b) 


Establish and enforce security configuration settings. 
Implement sub networks for publically accessible system components that 
are physically or logically separated from internal networks. 


Contingency Planning a) Establish, implement. and maintain plans for emergency response, backup 
operations, and post-disaster recovery for information systems to ensure 
the availability of critical information resources at all times. 

Incident Response a) Establish an operational incident handling capability for information 


Media and Information 
Protection 


Physical and Environmental 
Protection 


Network Protection 
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systems that includes adequate preparation, detection, analysis, 
containment, and recovery of cybersecurity incidents. Exercise this 


Protect information system media, both paper and digital. 

Limit access to information on information systems media to authorized 
users. 

Sanitize and destroy media no longer in use. 

Control the use of removable media throug 

Limit access to information systems, equipment, and respective 
operating environments to authorized individuals. 

Intrusion detection and prevention system employed on IT networks. 
Protect the physical and support infrastructure for all information systems. 
Protect information systems against environmental hazards. 


Drivers must be vetted in accordance with the Government Personnel 
Security Requirements. 

Drivers must be trained on specific security and emergency procedures. 
Drivers must be equipped with backup communications. 

Driver identity must be 100 percent confirmed before the pick-up of any 
Government product. 

Drivers must never leave Government products unattended, and two 
drivers may be required for longer transport routes or critical products 
during times of emergency. 

Truck pickup and deliveries must be logged and kept on record for a 
minimum of 12 months. 

Transport routes should be pre-planned and never deviated from except 
when approved or in the event of an emergency. 

Transport routes should be continuously evaluated based upon new 
threats, significant Lear events, weather, and other situations that may 


Government products must be secured with tamper resistant seals during 
transport, and the transport trailer must be locked and sealed. 

© Tamper resistant seals must be verified as “secure” after the 

product is placed in the transport vehicle. 

Government products should be continually monitored by GPS technology 
while in transport, and any deviations from planned routes should be 
investigated and documented. 
Cootonency plans should be in Leg to keep the product secure during 


10. Security Reporting Requirements 
Description: The partner facility shall notify the Agreement Officer within 24 hours of any activity or incident that 
is in violation of established security standards or indicates the loss or theft of government products. The facts and 


Description: The partner facility agrees to formal security audits conducted at the discretion of the government. 
Security audits may include both prime and subcontractor. 


